[repo] feat : add github branch policy checks

[jischeng]

Summary

• add a branch policy / validate pull request check to enforce the allowed source-to-target branch flow
• document the branch naming and pull request flow for dev-*, main-*, and master
• sync the repository instructions with the module-scoped branch and commit naming conventions

What this enforces in-repo

• master only accepts pull requests from <module>/main-*
• <module>/main-* only accepts pull requests from the same module's <module>/dev-*

What still needs repository admin setup

GitHub rulesets can require pull requests and block direct pushes on protected targets, but the source-branch restriction is enforced by the workflow in this PR.

After merging this PR, please add two repository rulesets in GitHub:

1. target master
   • require a pull request before merging
   • restrict updates
   • require status checks to pass before merging
   • required check: branch policy / validate
2. target */main-*
   • require a pull request before merging
   • restrict updates
   • require status checks to pass before merging
   • required check: branch policy / validate

Testing

• BASE_REF=master HEAD_REF=parser/main-gql-refactor python3 .github/scripts/validate_branch_policy.py
• BASE_REF=parser/main-gql-refactor HEAD_REF=parser/dev-gql-query-root-followup python3 .github/scripts/validate_branch_policy.py
• BASE_REF=parser/main-gql-refactor HEAD_REF=repo/dev-github-branch-policy python3 .github/scripts/validate_branch_policy.py
• git diff --check -- .claude/CLAUDE.md .claude/learnings.md .github/scripts/validate_branch_policy.py .github/workflows/branch_policy.yml docs/development/github_branch_policy.md

Changelog category (leave one):

• Not for changelog

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

• N/A

Documentation entry for user-facing changes

• Documentation is written (mandatory for new features)

Supersedes #7, which used a non-compliant repo/dev-* head branch for a master-targeted pull request.